Executive brief
The Linux kernel's Qualcomm PMIC USB Type-C driver has a race condition where a pending work item (reset_work) can execute after device removal, accessing freed memory. An attacker with local access could trigger this by removing a USB Type-C device at a specific moment, potentially causing a kernel crash or local privilege escalation through memory corruption.
Technical details
The vulnerability is a use-after-free race condition in the qcom_pmic_typec_pdphy_stop() function. The function disables IRQs but does not cancel the pending reset_work work item. If the IRQ handler schedules reset_work just before disable_irq() completes, the work will execute after the device is removed and the struct is freed via devm (device-managed memory). This allows arbitrary code execution in kernel context. The fix calls cancel_work_sync() immediately after disabling IRQs to ensure the work is fully canceled before cleanup. Local access and device unplug timing are required to trigger the race condition.
Affected products
- Linux Linux kernel multiple versions (patch backported across stable trees from 2.6 through 7.2)
Timeline
- 2026-09-16: disclosed: CVE-2026-90026 published
- 2026-08-19: patched: Upstream fix committed by Fan Wu
- 2026-09-14: other: Patch backported to stable trees